Briefing
A coordinated DNS hijacking attack compromised the centralized frontends of the Aerodrome and Velodrome decentralized exchanges, redirecting users to a sophisticated phishing site. This breach did not affect the underlying smart contracts, but instead tricked users into signing malicious unlimited token approval requests on the Base and Optimism networks. The primary consequence is direct user fund loss, with attackers successfully draining over $1 million in ETH, WETH, and USDC from connected wallets in a rapid, one-hour operation. This incident confirms that the security perimeter of a DeFi protocol is only as strong as its most centralized dependency.
Context
The decentralized finance ecosystem maintains a persistent and critical attack surface at the intersection of Web3 smart contracts and traditional Web2 infrastructure. Prior to this event, similar front-end compromises and DNS attacks were known vectors, demonstrating a systemic risk where the security of user assets remains dependent on the weakest link in the domain registration and hosting chain. This incident confirms the vulnerability class of relying on centralized domain providers for decentralized application access, a known risk that many protocols have yet to fully mitigate.
Analysis
The attack vector was a DNS hijacking exploit, specifically targeting the domain registrar’s system to modify the authoritative name server records for the DEX’s centralized domains (.finance and.box). This redirection sent legitimate user traffic to an attacker-controlled, visually identical phishing interface. The malicious frontend then prompted users to execute seemingly benign transactions, which were in reality permit or approve calls granting the attacker’s address unlimited spending allowance over their tokens. Once the user signed this malicious allowance, the attacker was able to immediately drain the approved assets from the user’s wallet, bypassing the security of the underlying smart contracts.
Parameters
- Total Funds Drained → $1 Million+ (Total value stolen from user wallets across Base and Optimism networks.)
- Attack Vector → DNS Hijacking (Compromise of the centralized domain registrar’s system.)
- Vulnerability Type → Malicious Token Approval (Phishing site tricked users into granting unlimited spending allowance.)
- Affected Chains → Base and Optimism (The two Layer 2 networks where the DEX operates.)
Outlook
Immediate mitigation requires all users who accessed the centralized domains to revoke token approvals granted during the compromise window, utilizing tools like Revoke.cash. The strategic outlook mandates that DeFi protocols accelerate the transition to fully decentralized frontends via services like ENS and IPFS to eliminate the single point of failure inherent in centralized domain registration. This event will likely establish a new security best practice → a mandatory shift away from Web2 DNS for critical user-facing interfaces to secure the last mile of user interaction.
Verdict
This DNS hijacking confirms that a protocol’s smart contract security is irrelevant if its centralized user interface is the weakest link, necessitating an immediate, systemic migration to decentralized hosting solutions.
